This is the documentation for Wazuh 3.1. Check out the docs for the latest version of Wazuh!

client_buffer

XML section name

<client_buffer>
</client_buffer>

Configure the agent bucket parameters in order to avoid events flooding.

Options

disabled

This parameter allows to disable the Agent Buffer and send events to the manager without any congestion control.

Default value no
Allowed values The options accepted are yes and no.

Warning

Disabling this functionality in large environments, agents may collapse the manager and the network.

disable

Deprecated since version 3.1.

This parameter allows to disable the Agent Buffer and send events to the manager without any congestion control. Due to compatibility issues, it is better to replace this option by disabled.

Default value no
Allowed values The options accepted are yes and no.

queue_size

The capacity of Agent Buffer in number of events.

Default value 5000
Allowed values Any number between 1 and 100000.

length

Deprecated since version 3.0.

The capacity of Agent Buffer in number of events.

Default value 5000
Allowed values Any number between 1 and 100000.

Warning

Even if this field is accepted, it is recommended to replace it with queue_size.

events_per_second

Specifies the number of events sent to the manager per second.

Default value 500
Allowed values Any number between 1 and 1000.

Default configuration

<client_buffer>
  <!-- Agent buffer options -->
  <disabled>no</disabled>
  <queue_size>5000</queue_size>
  <events_per_second>500</events_per_second>
</client_buffer>